CVE-2026-89045CWE-835

CVE-2026-89045

Medium · published September 10, 2026

CVSS v3.1
4.0
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocking all other threads from accessing the stream.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.1 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00177 · 6.9th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-09-10T22:18Z
References (7)
https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java#L133 · [email protected]https://github.com/luben/zstd-jni/commit/dd08685ef913a32e76fb27f43470035c06758646 · [email protected]https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 · [email protected]https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm · [email protected]https://www.vulncheck.com/advisories/zstd-jni-1.4.8-4-through-1.5.7-13-denial-of-service-via-negative-length · [email protected]https://github.com/luben/zstd-jni/security/advisories/GHSA-9jx2-gfp9-phfm · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/luben/zstd-jni · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 17:39Z
    zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
    cvelistv5